linzer 0.6.3 → 0.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2a241d8621efa2c0ed148bfcf9f4973296f1dd342d1ddddea7840a55f6f6385
-  data.tar.gz: 74b4b845ec51e87b1a616be0d2757a6e123ffb9d1ec2b5c4234edc7644522662
+  metadata.gz: 6d5b1a0dfcd7d402e3a5bf2e22102271e3273e1f7092e4dad09ae7078e04dcf3
+  data.tar.gz: 197933c6728e55678e7f29e5161b57fecd0ca39bacb586260412674a538cd8b1
 SHA512:
-  metadata.gz: '067900eddd392626dcc1a0bdec5f8c7b0b00fd67dbe938376231f4c9c1262245e6ed2dcb1b4ea8af37a10c50cd47747b553b315869104342c5b94e2b45810132'
-  data.tar.gz: 7f1293c1feff0c225bda479422d77dc3ac1489c6c8d2233cfdd6ef3bc7a689345f091987ce9f3600a34f74ffd9688eeebdbd048a5e54ec992df1fbc1a1e65355
+  metadata.gz: f6da1cd0829f06c15f1a5cf66af191836294ffeea666e15f969f28c7171bf2b8e887b1fb5aa405fbfc7c840719ce82cc6cdae3b7238f987bb00f6c71e238c930
+  data.tar.gz: 047a03b94451dcffe5982165bc14acc7c6419fe4d8ff9f72e2d4510a77fae87c5960fabdaa0ff129d89724b0185a37454e3a6d9ec6ea903192eadc013e1abb64

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 ## [Unreleased]
 
+## [0.6.5] - 2025-04-09
+
+- Add support for RSA (RSASSA-PKCS1-V1_5) and improve RSASSA-PSS handling.
+  Pull request [#10](https://github.com/nomadium/linzer/pull/10)
+  by [oneiros](https://github.com/oneiros).
+
+## [0.6.4] - 2025-04-04
+
+- Allow validating the `created` parameter to mitigate the
+  risk of replay attacks.
+  Pull request [#8](https://github.com/nomadium/linzer/pull/8)
+  by [oneiros](https://github.com/oneiros).
+
 ## [0.6.3] - 2025-03-29
 
 - Parse signature structured fields values as ASCII string.

data/README.md

@@ -117,6 +117,15 @@ Linzer.verify(pubkey, message, signature)
 # => true
 ```
 
+To mitigate the risk of "replay attacks" (i.e. an attacker capturing a message with a valid signature and re-sending it at a later point) applications may want to validate the `created` parameter of the signature. Linzer can do this automatically when given the optional `no_older_than` keyword argument:
+
+```ruby
+Linzer.verify(pubkey, message, signature, no_older_than: 500)
+```
+
+`no_older_than` expects a number of seconds, but you can pass anything that to responds to `#to_i`, including an `ActiveSupport::Duration`.
+`::verify` will raise if the `created` parameter of the signature is older than the given number of seconds.
+
 ### What if an invalid signature if verified?
 
 ```ruby
@@ -151,7 +160,7 @@ pp signature.to_h
 
 For now, to consult additional details just take a look at source code and/or the unit tests.
 
-Please note that is still early days and extensive testing is still ongoing. For now only the following algorithms are supported: RSASSA-PSS using SHA-512, HMAC-SHA256, Ed25519 and ECDSA (P-256 and P-384 curves).
+Please note that is still early days and extensive testing is still ongoing. For now the following algorithms are supported: RSASSA-PSS using SHA-512, RSASSA-PKCS1-v1_5 using SHA-256, HMAC-SHA256, Ed25519 and ECDSA (P-256 and P-384 curves). JSON Web Signature (JWS) algorithms mentioned in the RFC are not supported yet.
 
 I'll be expanding the library to cover more functionality specified in the RFC
 in subsequent releases.

data/lib/linzer/key/helper.rb

@@ -4,24 +4,38 @@ module Linzer
   class Key
     module Helper
       def generate_rsa_pss_sha512_key(size, key_id = nil)
-        material = OpenSSL::PKey::RSA.generate(size)
-        Linzer::RSA::Key.new(material, id: key_id, digest: "SHA512")
+        material = OpenSSL::PKey.generate_key("RSASSA-PSS")
+        Linzer::RSAPSS::Key.new(material, id: key_id, digest: "SHA512")
       end
 
       def new_rsa_pss_sha512_key(material, key_id = nil)
         key = OpenSSL::PKey.read(material)
-        Linzer::RSA::Key.new(key, id: key_id, digest: "SHA512")
+        Linzer::RSAPSS::Key.new(key, id: key_id, digest: "SHA512")
       end
 
+      # XXX: investigate: was this method made redundant after:
+      # https://github.com/nomadium/linzer/pull/10
       def new_rsa_pss_sha512_public_key(material, key_id = nil)
         key = OpenSSL::PKey::RSA.new(material)
-        Linzer::RSA::Key.new(key, id: key_id, digest: "SHA512")
+        Linzer::RSAPSS::Key.new(key, id: key_id, digest: "SHA512")
       end
 
-      # XXX: to-do
-      # Linzer::RSA::Key
-      # def new_rsa_v1_5_sha256_key
-      # def generate_rsa_v1_5_sha256_key
+      def generate_rsa_v1_5_sha256_key(size, key_id = nil)
+        material = OpenSSL::PKey::RSA.generate(size)
+        Linzer::RSA::Key.new(material, id: key_id, digest: "SHA256")
+      end
+
+      def new_rsa_v1_5_sha256_key(material, key_id = nil)
+        key = OpenSSL::PKey.read(material)
+        Linzer::RSA::Key.new(key, id: key_id, digest: "SHA256")
+      end
+
+      # XXX: investigate: was this method made redundant after:
+      # https://github.com/nomadium/linzer/pull/10
+      def new_rsa_v1_5_sha256_public_key(material, key_id = nil)
+        key = OpenSSL::PKey.read(material)
+        Linzer::RSA::Key.new(key, id: key_id, digest: "SHA256")
+      end
 
       def generate_hmac_sha256_key(key_id = nil)
         material = OpenSSL::Random.random_bytes(64)

data/lib/linzer/rsa.rb

@@ -15,13 +15,7 @@ module Linzer
 
       def verify(signature, data)
         # XXX: should check if the key is usable for verifying
-        return true if @material.verify_pss(
-          @params[:digest],
-          signature,
-          data,
-          salt_length: @params[:salt_length] || :auto,
-          mgf1_hash:   @params[:digest]
-        )
+        return true if @material.verify(@params[:digest], signature, data)
         false
       end
     end

data/lib/linzer/rsa_pss.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Linzer
+  module RSAPSS
+    SALT_LENGTH = 64
+
+    class Key < Linzer::Key
+      def validate
+        super
+        validate_digest
+      end
+
+      def sign(data)
+        # XXX: should check if the key is usable for signing
+        @material.sign(@params[:digest], data, signature_options)
+      end
+
+      def verify(signature, data)
+        # XXX: should check if the key is usable for verifying
+        return true if @material.verify(
+          @params[:digest],
+          signature,
+          data,
+          signature_options
+        )
+        false
+      end
+
+      private
+
+      def signature_options
+        {
+          rsa_padding_mode: "pss",
+          rsa_pss_saltlen: @params[:salt_length] || SALT_LENGTH,
+          rsa_mgf1_md:   @params[:digest]
+        }
+      end
+    end
+  end
+end

data/lib/linzer/signature.rb

@@ -14,6 +14,18 @@ module Linzer
     alias_method :components, :metadata
     alias_method :bytes, :value
 
+    def created
+      Integer(parameters["created"])
+    rescue
+      return nil if parameters["created"].nil?
+      raise Error.new "Signature has a non-integer `created` parameter"
+    end
+
+    def older_than?(seconds)
+      raise Error.new "Signature is missing the `created` parameter" if created.nil?
+      (Time.now.to_i - created) > seconds
+    end
+
     def to_h
       {
         "signature" => Starry.serialize({label => value}),

data/lib/linzer/verifier.rb

@@ -5,8 +5,8 @@ module Linzer
     class << self
       include Common
 
-      def verify(key, message, signature)
-        validate message, key, signature
+      def verify(key, message, signature, no_older_than: nil)
+        validate message, key, signature, no_older_than: no_older_than
 
         parameters = signature.parameters
         components = signature.components
@@ -18,7 +18,7 @@ module Linzer
 
       private
 
-      def validate(message, key, signature)
+      def validate(message, key, signature, no_older_than: nil)
         raise Error.new "Message to verify cannot be null"       if message.nil?
         raise Error.new "Key to verify signature cannot be null" if key.nil?
         raise Error.new "Signature to verify cannot be null"     if signature.nil?
@@ -31,6 +31,9 @@ module Linzer
         raise Error.new "Components cannot be null"             if signature.components.nil?
 
         validate_components message, signature.components
+
+        return unless no_older_than
+        raise Error.new "Signature created more than #{no_older_than} seconds ago" if signature.older_than?(no_older_than.to_i)
       end
 
       def verify_or_fail(key, signature, data)

data/lib/linzer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Linzer
-  VERSION = "0.6.3"
+  VERSION = "0.6.5"
 end

data/lib/linzer.rb

@@ -14,6 +14,7 @@ require_relative "linzer/message"
 require_relative "linzer/signature"
 require_relative "linzer/key"
 require_relative "linzer/rsa"
+require_relative "linzer/rsa_pss"
 require_relative "linzer/hmac"
 require_relative "linzer/ed25519"
 require_relative "linzer/ecdsa"
@@ -32,8 +33,8 @@ module Linzer
       Linzer::Request.build(verb, uri, params, headers)
     end
 
-    def verify(pubkey, message, signature)
-      Linzer::Verifier.verify(pubkey, message, signature)
+    def verify(pubkey, message, signature, no_older_than: nil)
+      Linzer::Verifier.verify(pubkey, message, signature, no_older_than: no_older_than)
     end
 
     def sign(key, message, components, options = {})

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.6.3
+  version: 0.6.5
 platform: ruby
 authors:
 - Miguel Landaeta
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-03-29 00:00:00.000000000 Z
+date: 2025-04-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: openssl
@@ -104,7 +103,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.1.2
-description:
 email:
 - miguel@miguel.cc
 executables: []
@@ -129,6 +127,7 @@ files:
 - lib/linzer/request.rb
 - lib/linzer/response.rb
 - lib/linzer/rsa.rb
+- lib/linzer/rsa_pss.rb
 - lib/linzer/signature.rb
 - lib/linzer/signer.rb
 - lib/linzer/verifier.rb
@@ -140,7 +139,6 @@ metadata:
   homepage_uri: https://github.com/nomadium/linzer
   source_code_uri: https://github.com/nomadium/linzer
   changelog_uri: https://github.com/nomadium/linzer/blob/master/CHANGELOG.md
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -155,8 +153,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.3
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: An implementation of HTTP Messages Signatures (RFC9421)
 test_files: []